The Home Depot, Inc. v. Steadfast Insurance Co.

 IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF OHIO WESTERN DIVISION The Home Depot, Inc., et al., : Case No. 1:21-cv-242 : Plaintiffs, : Judge Susan J. Dlott : v. : : Steadfast Insurance Company, et al., : Order Granting Defendants’ Motion for : Summary Judgement and Denying Defendants. : Plaintiff’s Motions This matter is before the Court on Plaintiffs The Home Depot, Inc.’s and Home Depot U.S.A., Inc.’s (“Home Depot”) Motion for Partial Summary Judgment (Doc. 44), Defendant Steadfast Insurance Co.’s (“Steadfast”) Motion for Summary Judgment (Doc. 63), and Defendant Great American Assurance Co.’s (“Great American”) Motion for Summary Judgment (Doc. 66). Home Depot has also filed a Motion to Exclude Expert Witness Testimony (Doc. 55). For the reasons that follow, the Defendants’ Motions are GRANTED, and Plaintiff’s Motions are DENIED. I. Background1 Plaintiff Home Depot is suing its insurers, Defendants Great American Insurance Co. and Steadfast Insurance Co., for breach of duties to defend and indemnify. Home Depot suffered a major data breach in which the payment card information, including credit and debit card numbers, of millions of customers was stolen. After the data breach was discovered, banks cancelled the payment cards of their customers and issued them new cards. The financial institutions sued Home Depot for the cost of this replacement, and Home Depot settled the case. 1 Unless otherwise noted, the facts in this Order are taken from the undisputed facts submitted by the parties. Home Depot seeks to recoup the cost of the settlement from Defendants, who provided Home Depot’s general commercial liability insurance. The policies cover damages caused by the “loss of use of tangible property that is not physically injured” (Doc. 43-2 PageID 663, 677)2 if that loss is caused by an “occurrence.” (Id. at 663.) However, the policies also had an electronic data exclusion that excluded loss of use that “arise[s] out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” (Id. at 667.) Defendants denied coverage because they believed that the damages were related to damages to electronic data rather than the physical cards. II. Legal Standard Federal Rule of Civil Procedure 56 governs motions for summary judgment. Summary judgment is appropriate if “there is no genuine issue as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). The movant has the burden to show that no genuine issues of material fact are in dispute. See Matsushita Elec. Indus. Co., Ltd. v. Zenith Radio Corp., 475 U.S. 574, 585–587 (1986); Provenzano v. LCI Holdings, Inc., 663 F.3d 806, 811 (6th Cir. 2011). The movant may support a motion for summary judgment with affidavits or other proof or by exposing the lack of evidence on an issue for which the nonmoving party will bear the burden of proof at trial. Celotex Corp. v. Catrett, 477 U.S. 317, 322–324 (1986). In responding to a summary judgment motion, the nonmoving party may not rest upon the pleadings but must “present affirmative evidence in order to defeat a properly supported motion for summary judgment.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 257 (1986). 2 This case involves three different insurance policies. The parties agree that the relevant language in the policies, with the exception of certain language relating to duties to defend, is identical. For the sake of convenience, the Court will cite the Steadfast Primary Policy. A court’s task is not “to weigh the evidence and determine the truth of the matter but to determine whether there is a genuine issue for trial.” Id. at 249. “[F]acts must be viewed in the light most favorable to the nonmoving party only if there is a ‘genuine’ dispute as to those facts.” Scott v. Harris, 550 U.S. 372, 380 (2007) (emphasis added); see also EEOC v. Ford Motor Co., 782 F.3d 753, 760 (6th Cir. 2015) (en banc) (quoting Scott). A genuine issue for trial exists when there is sufficient “evidence on which the jury could reasonably find for the plaintiff.” Anderson, 477 U.S. at 252; see also Shreve v. Franklin Cnty., Ohio, 743 F.3d 126, 132 (6th Cir. 2014) (“A dispute is ‘genuine’ only if based on evidence upon which a reasonable jury could return a verdict in favor of the non-moving party.”) (emphasis in original) (citation omitted). “Factual disputes that are irrelevant or unnecessary will not be counted.” Anderson, 477 U.S. at 248. “The court need consider only the cited materials, but it may consider other materials in the record.” Fed. R. Civ. P. 56(c)(3). “Where the parties have filed cross-motions for summary judgment, the court must consider each motion separately on its merits, since each party, as a movant for summary judgment, bears the burden to establish both the nonexistence of genuine issues of material fact and that party's entitlement to judgment as a matter of law.” In re Morgeson, 371 B.R. 798, 800– 01 (B.A.P. 6th Cir. 2007). III. General Principles of Law Federal courts in diversity cases apply the choice of law rules of the state in which they sit. Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941). Ohio has adopted the approach of the Restatement (Second) of the Law of Conflicts, which applies the law of “the state with the most significant relationship to the transaction and the parties.” Power-Tek Sols. Servs., LLC v. Techlink, Inc., 403 F.3d 353, 357 (6th Cir. 2005) (quoting Restatement (Second) of the Law of Conflicts § 188(1)). Factors the Court considers include the place of contracting, the place of negotiation, the place of performance, the location of the contract’s subject matter, and the places of incorporation and business of the parties. Id. In this case, the place of contracting and negotiation are both Georgia. (Doc. 44 PageID 1696.) Furthermore, Home Depot’s principal place of business is also in Georgia. (Id.) The parties agree that Georgia law applies. (Doc. 20 PageID 406; Doc. 44 PageID 1696; Doc. 63 PageID 3323.) Therefore, the Court will apply Georgia law. Under Georgia law, courts interpret insurance contracts according to the plain meaning of the terms of the contract. Alea London Ltd. v. Lee, 649 S.E.2d 542, 544 (Ga. Sup. Ct. 2007). Ambiguous provisions are construed in favor of coverage. Gen Steel, Inc. v. Delta Bldg. Sys., Inc., 676 S.E.2d 451, 453 (Ga. Sup. Ct. 2009). Exclusions in insurance policies are to be read narrowly. Alley v. Great Am. Ins. Co., 287 S.E.2d 613, 616 (Ga. Ct. App. 1981). IV. Analysis a. Loss of Use of Tangible Property Not Physically Injured The policies at issue cover “property damage” which is defined by the contracts as either “physical injury to tangible property” or “loss of use of tangible property that is not physically injured.” (Doc. 43-2 PageID 663.) The parties agree that there was no physical injury to property. Home Depot argues that the payment cards were tangible property not physically injured, and that there was a loss of use of that tangible property due to the data breach. The parties agree that the payment cards are tangible property and that they were not physically injured. The parties disagree about whether there was a loss of use of the payment cards. Home Depot argues that there was a loss of use of the payment cards in two ways. First, Home Depot argues that there was a partial loss of use when customers, upon learning of the data breach, reduced their card usage, thereby reducing the fees and interest the financial institutions could collect. Second, Home Depot argues that there was a complete loss of use when the financial institutions cancelled the cards. The loss of fees and interest incurred by the financial institutions after the data breach was revealed but prior to the cancellation of the payment cards was not a loss of use of the payment cards. Home Depot argues that the financial institutions’ loss of fees qualifies as a loss of use of tangible property because the data breach made the continued use of the payment cards too risky, and as a result, cardholders reduced their usage of the affected cards. Home Depot bases this claim on the financial institutions’ complaint in the underlying lawsuit. (Doc. 82 PageID 3945–46.) The underlying complaint states only that the lost interest was caused by the data breach. (Doc. 43-19 PageID 1508.) As a result, Home Depot has not put forth evidence suggesting that the loss of fees and interest was due to the loss of security in the physical numbers printed on the card rather than from the loss of security of electronic data or simply inaccurate cardholder perception of the security of their cards. While it is true that there was a reduction in the use of the payment cards, that does not mean that the physical payment cards themselves partially lost their use. The financial institutions’ cancellation of the payment cards, however, did result in a loss of use of tangible property. The physical cards themselves, with the numbers printed on them, are tangible property. The numbers printed on the cards are useful for reminding cardholders of their card numbers when doing things like entering their card numbers online. When the payment cards were cancelled, the numbers printed on the cards no longer reflected the cardholders’ actual payment information. As a result, the payment cards could no longer be used to remind cardholders of their payment information. This was a loss of use. While it is true that the cards are also useful in that they store electronic data, and there was a loss of use of this electronic data, there was an independent loss of use of the physical cards themselves. Defendants, citing cases from other states, argue that “loss of use” refers only to a temporary loss. The Court disagrees. Defendants cite no cases applying Georgia law in support of their argument. Several of the cases on which Defendants rely are factually distinguishable from the case at bar. For example, Advanced Network, Inc. v. Peerless Insurance Co., 190 Cal.App.4th 1054 (Cal. Ct. App. 2010), concerned the theft of cash. Collin v. American Empire Insurance Co., 21 Cal.App.4th 787 (Cal. Ct. App. 1994), likewise concerns conversion of property. Regardless, while the Court does recognize that there may be a difference between loss and loss of use, that difference does not depend on whether the loss is temporary or permanent. Rather, if there is a distinction, the most natural reading of that distinction is that loss refers to a physical loss of the property, while loss of use refers to property that had not been physically lost but has lost its use.3 In this case, the payment cards were not physically lost. The cardholders still possessed the physical cards at the time of the cards’ cancellation. Rather, the cancellation rendered the cards useless. This was a loss of use, not a loss. Because there was a loss of use of a tangible object not physically injured, there was property damage under the terms of the policy. b. Caused by an Occurrence The policies cover losses of use only if they are caused by an occurrence. (Doc. 43-2 PageID 663.) Defendants dispute both that the data breach was an occurrence and that it caused the cancellation of the payment cards. Defendants further argue that the card cancellation itself cannot qualify as an occurrence either. The Court will first discuss whether either the data breach or the cancellation qualify as occurrences under the language of the insurance policies before discussing the issue of causation. 3 At least one court, applying Georgia law, has held that even conversion of property constitutes loss of use, because once the property has been taken, the insured is no longer able to use it. Barrs v. Auto-Owners Ins. Co., 564 F.Supp.3d 1362 (M.D. Ga. 2021). However, the Court need not consider whether or not there is a distinction between loss of use and loss because even if there is such a distinction, there was a loss of use in this case. The insurance policies define occurrence as “an accident.” (Doc. 43-2 PageID 677.) Under Georgia law, an unforeseen intentional act by a third person qualifies as an accident for the purposes of insurance policies. Georgia courts have held that accident refers to “an event which takes place without one’s foresight or expectation or design.” Cincinnati Ins. Co. v. Magnolia Estates, Inc., 648 S.E.2d 498 (Ga. Ct. App. 2007) (quoting Crook v. Ga. Farm Bureau Mut. Ins. Co., 428 S.E.2d 802 (Ga. Ct. App. 1993)). While Defendants argue that, since these cases speak of one’s foresight or design, the fact that the data breach and cancellation happened by the design of a third party means that the data breach and cancellation are not accidents. However, both Cincinnati Ins. Co. and Crook involve intentional acts of third parties. Read in context, it is clear that “one” must refer to the insured rather than a third party. The Georgia Court of Appeals has sometimes said simply that intentional acts are not occurrences. See Presidential Hotel v. Canal Ins. Co., 373 S.E.2d 671, 673 (Ga. Ct. App. 1988). However, the Presidential Hotel line of cases concerns intentional acts by agents of the insured. Id. As a result, these cases are distinguishable from Crook. The intentional acts in this case were not performed by Home Depot, but rather by hackers and financial institutions. Home Depot did not intend or expect this chain of events to occur. Therefore, the Court concludes that both the data breach and the cancellation were occurrences under the terms of the policy. Defendants argue that, because the cards could still function securely after the data breach, the data breach is not the cause of the cancellation of the cards, and therefore the cancellation was not caused by an accident. However, the cancellation of the cards is itself an accident for the purposes of the insurance policies, so it is irrelevant whether the financial institutions were forced by the data breach to cancel the cards. c. Arising out of the Loss of Use of Electronic Data Although the Court agrees with Home Depot that it has proved a loss of use of tangible property caused by an occurrence, the Court still must consider whether the electronic data exclusion applies. Payment cards are useful in two ways. First, the cards store electronic data which can be automatically transmitted by inserting the cards into a payment card reader. Second, the card information is physically printed on the card, allowing the cardholder to easily enter their card information to make online purchases. Home Depot concedes that the loss of use of the electronic data stored on the cards is not covered by the policies. However, Home Depot contends that the loss of use of the physical numbers on the card are covered by the policy. However, because the loss of use of the physical numbers on the card arises out of the loss of use of electronic data, the electronic data exclusion applies and the loss of use of the cards is not covered by the policy. In this case, the physical numbers lost their use because the financial institutions cancelled the cards. Once the physical numbers printed on the original cards no longer corresponded to the card holders’ actual payment information, the numbers printed on the card could no longer be used to make purchases, rendering them useless. The cancellation is inextricably intertwined with electronic data. The use of electronic data was lost in two ways in this case. First, when the card data was stolen in the data breach, it was no longer secure. Home Depot tries to claim that there was no loss of use of the electronic data because, if anything, the data was actually more accessible after the data breach. However, Home Depot cannot have it both ways. If, as Home Depot argues, the payment cards lost their use when the data breach rendered them insecure, then so too did the electronic data lose its use after the data breach rendered it insecure. The electronic data also lost its use when the payment cards were canceled by the financial institutions. The strings of numbers on the payment cards are not useful in and of themselves. Rather, they are useful only because they correspond to the cardholder’s actual payment information. When the cards were cancelled, the electronic data, consisting of the old payment card numbers stored on computers, no longer corresponded to the cardholders’ actual payment information and so became worthless. By extension, once the electronically stored payment information no longer matched the numbers printed on the card, the cards were useless. Thus, the loss of use of the physical card numbers arose out of the loss of use of the electronically stored card numbers. Because the electronic data exclusion applies, there is no coverage under the policies at issue in this case. V. Conclusion For the reasons stated above, Defendants’ Motions for Summary Judgment (Docs. 63 and 66) are GRANTED. Plaintiff’s Motion for Summary Judgment (Doc. 44) is DENIED. Because neither of the expert reports would affect the Court’s ruling in this case, the Motion to Exclude Expert Witness Testimony is DENIED AS MOOT. IT IS SO ORDERED. S/Susan J. Dlott________________ Susan J. Dlott United States District Judge